CVE-2024-48898 - Vulnerability Details

Vendors	Products
Moodle	Moodle

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2318820

Type	Values Removed	Values Added
First Time appeared		Moodle Moodle moodle
CPEs		cpe:2.3:a:moodle:moodle::::::::
Vendors & Products		Moodle Moodle moodle

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
Title		Moodle: some users can delete audiences of other reports
Weaknesses		CWE-862
References		https://bugzilla.redhat.com/show_bug.cgi?id=2318820

Show plain JSON

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-48898", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-10-09T12:15:07.577Z", "datePublished": "2024-11-18T11:14:26.903Z", "dateUpdated": "2024-11-18T11:14:26.903Z"}, "containers": {"cna": {"title": "Moodle: some users can delete audiences of other reports", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from."}], "affected": [{"versions": [{"status": "affected", "version": "4.4.0", "lessThan": "4.4.4", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.8", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.11", "versionType": "semver"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.14", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.1.0", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://moodle.org/", "defaultStatus": "unaffected"}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820", "name": "RHBZ#2318820", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-10-15T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-862: Missing Authorization", "timeline": [{"lang": "en", "time": "2024-10-15T17:23:13.259000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-10-15T00:00:00+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-18T11:14:26.903Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-18T14:56:14.483356Z", "id": "CVE-2024-48898", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T14:56:22.880Z"}}]}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

cveMetadata : { »

cveId : CVE-2024-48898 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2024-10-09T12:15:07.577Z (string)

datePublished : 2024-11-18T11:14:26.903Z (string)

dateUpdated : 2024-11-18T11:14:26.903Z (string)

}

containers : { »

cna : { »

title : Moodle: some users can delete audiences of other reports (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from. (string)

}

]

affected : [ »

0 : { »

versions : [ »

0 : { »

status : affected (string)

version : 4.4.0 (string)

lessThan : 4.4.4 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 4.3.0 (string)

lessThan : 4.3.8 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 4.2.0 (string)

lessThan : 4.2.11 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 4.1.0 (string)

lessThan : 4.1.14 (string)

versionType : semver (string)

}

4 : { »

status : affected (string)

version : 0 (string)

lessThan : 4.1.0 (string)

versionType : semver (string)

}

]

packageName : moodle (string)

collectionURL : https://moodle.org/ (string)

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2318820 (string)

name : RHBZ#2318820 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

datePublic : 2024-10-15T00:00:00+00:00 (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-862 (string)

description : Missing Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-862: Missing Authorization (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2024-10-15T17:23:13.259000+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-10-15T00:00:00+00:00 (string)

value : Made public. (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-18T11:14:26.903Z (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-18T14:56:14.483356Z (string)

id : CVE-2024-48898 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-18T14:56:22.880Z (string)

}

]

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-48898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-18T14:56:14.483356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T14:56:06.172Z"}}], "cna": {"title": "Moodle: some users can delete audiences of other reports", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}], "affected": [{"versions": [{"status": "affected", "version": "4.4.0", "lessThan": "4.4.4", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.8", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.11", "versionType": "semver"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.14", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.1.0", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://moodle.org/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-10-15T17:23:13.259000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-10-15T00:00:00+00:00", "value": "Made public."}], "datePublic": "2024-10-15T00:00:00+00:00", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820", "name": "RHBZ#2318820", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-18T11:14:26.903Z"}, "x_redhatCweChain": "CWE-862: Missing Authorization"}}, "cveMetadata": {"cveId": "CVE-2024-48898", "state": "PUBLISHED", "dateUpdated": "2024-11-18T11:14:26.903Z", "dateReserved": "2024-10-09T12:15:07.577Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-11-18T11:14:26.903Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-48898 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-18T14:56:14.483356Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-18T14:56:06.172Z (string)

}

]

cna : { »

title : Moodle: some users can delete audiences of other reports (string)

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

]

affected : [ »

0 : { »

versions : [ »

0 : { »

status : affected (string)

version : 4.4.0 (string)

lessThan : 4.4.4 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 4.3.0 (string)

lessThan : 4.3.8 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 4.2.0 (string)

lessThan : 4.2.11 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 4.1.0 (string)

lessThan : 4.1.14 (string)

versionType : semver (string)

}

4 : { »

status : affected (string)

version : 0 (string)

lessThan : 4.1.0 (string)

versionType : semver (string)

}

]

packageName : moodle (string)

collectionURL : https://moodle.org/ (string)

defaultStatus : unaffected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2024-10-15T17:23:13.259000+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-10-15T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2024-10-15T00:00:00+00:00 (string)

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2318820 (string)

name : RHBZ#2318820 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-862 (string)

description : Missing Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-18T11:14:26.903Z (string)

}

x_redhatCweChain : CWE-862: Missing Authorization (string)

}

cveMetadata : { »

cveId : CVE-2024-48898 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-18T11:14:26.903Z (string)

dateReserved : 2024-10-09T12:15:07.577Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2024-11-18T11:14:26.903Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2D74BD7-3907-49E1-B2FC-A45108CB5AF0", "versionEndIncluding": "4.1.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCE4F475-9272-4891-B690-3AB9720CD2D8", "versionEndIncluding": "4.2.11", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6A31566-F7AD-4FD4-82A6-CCE0D52123B8", "versionEndIncluding": "4.3.8", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "E073E9C6-D72C-4C82-92AF-6C02B81EB28B", "versionEndIncluding": "4.4.4", "versionStartIncluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Moodle. Los usuarios con acceso para eliminar audiencias de los informes podr\u00edan eliminar audiencias de otros informes para los que no tienen permiso de eliminaci\u00f3n."}], "id": "CVE-2024-48898", "lastModified": "2024-11-20T14:46:16.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-11-18T12:15:18.363", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A2D74BD7-3907-49E1-B2FC-A45108CB5AF0 (string)

versionEndIncluding : 4.1.14 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CCE4F475-9272-4891-B690-3AB9720CD2D8 (string)

versionEndIncluding : 4.2.11 (string)

versionStartIncluding : 4.2.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A6A31566-F7AD-4FD4-82A6-CCE0D52123B8 (string)

versionEndIncluding : 4.3.8 (string)

versionStartIncluding : 4.3.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E073E9C6-D72C-4C82-92AF-6C02B81EB28B (string)

versionEndIncluding : 4.4.4 (string)

versionStartIncluding : 4.4.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from. (string)

}

1 : { »

lang : es (string)

value : Se encontró una vulnerabilidad en Moodle. Los usuarios con acceso para eliminar audiencias de los informes podrían eliminar audiencias de otros informes para los que no tienen permiso de eliminación. (string)

}

]

id : CVE-2024-48898 (string)

lastModified : 2024-11-20T14:46:16.237 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-11-18T12:15:18.363 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2318820 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-862 (string)

}

]

source : secalert@redhat.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object